Description: What are we doing wrong and how can we fix it? What happens when badness happens before we could fix things? Where is my data? What is important from a DFIR perspective? All these questions and more will be answered in this presentation. We will cover how the adversary compromises you, and then how to rapidly respond. This is not a “step-by-step”, but rather an overview of how we need to change the current mindset regarding acquisition and analysis of data in an investigation.